semgrep

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime git cloning of third‑party Semgrep rulesets (e.g., https://github.com/trailofbits/semgrep-rules) and mandates using those local clones as required --config inputs to semgrep, meaning remote content is fetched at runtime and directly controls the scanner's behavior.